Ultimate Addons for Contact Form 7 vulnerabilities

Product

Ultimate Addons for Contact Form 7

by Themefic · last CVE Sep 30, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities16 In the news0 Timeline

Severity mix

Critical 1High 5Medium 10Low 0

Severity

All severities16 Critical1 High5 Medium10 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Ultimate Addons for Contact Form 7 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-95586	6.5	0%	Sep 23	WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability Affected: through 3.5.50
CVE-2026-32460	6.5	0%	Mar 13	WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.36 - Cross Site Scripting (XSS) vulnerability Affected: through 3.5.36
CVE-2023-1615	6.5	1%	Jun 9	The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23 Affected: through 3.1.23
CVE-2025-6212	6.1	0%	Jun 26	Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module Affected: 3.5.11 before 3.5.20
CVE-2023-49766	6.1	0%	Dec 14	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 allows Stored XSS.This issue… Affected: through 3.2.0
CVE-2023-30493	6.1	0%	Sep 27	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.2.0 versions Affected: before 3.2.1
CVE-2023-2803	6.1	0%	Aug 14	The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… Affected: before 3.1.29
CVE-2025-6756	5.4	0%	Jul 1	Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode Affected: before 3.5.22
CVE-2026-24945	5.3	0%	Feb 3	WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability Affected: through 3.5.34
CVE-2023-2802	4.8	0%	Aug 14	The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… Affected: before 3.1.29